CompTIA CS0-003 Exam - Topic 4 Question 46 Discussion

Actual exam question for CompTIA's CS0-003 exam

Question #: 46
Topic #: 4

A payroll department employee was the target of a phishing attack in which an attacker impersonated a department director and requested that direct deposit information be updated to a new account. Afterward, a deposit was made into the unauthorized account. Which of the following is one of the first actions the incident response team should take when they receive notification of the attack?

AScan the employee's computer with virus and malware tools.

BReview the actions taken by the employee and the email related to the event

CContact human resources and recommend the termination of the employee.

DAssign security awareness training to the employee involved in the incident.

Show Suggested Answer

Suggested Answer: B

In case of a phishing attack, it's crucial to review what actions were taken by the employee and analyze the phishing email to understand its nature and impact.Reference:CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 6, page 246;CompTIA CySA+ CS0-003 Certification Study Guide, Chapter 6, page 255.

by Lorriane at Jul 09, 2025, 04:02 PM

Limited Time Offer

25%

Off

Get Premium CS0-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jeanice

5 months ago

I thought D was a no-brainer, but B makes sense too.

upvoted 0 times

...

Merri

5 months ago

A scan is good, but B is more critical first step.

upvoted 0 times

...

Vonda

6 months ago

Surprised they fell for that! How did they not verify?

upvoted 0 times

...

Kathryn

6 months ago

Wait, why would you terminate the employee? Seems harsh!

upvoted 0 times

...

Marjory

6 months ago

Definitely B, need to see what went wrong.

upvoted 0 times

...

Lashon

6 months ago

I recall a similar scenario where assigning security awareness training was suggested, but I wonder if that should come after we investigate the email.

upvoted 0 times

...

Patti

7 months ago

I feel like contacting HR to recommend termination is a bit extreme. We should focus on understanding the incident first, right?

upvoted 0 times

...

Raymon

7 months ago

I'm not entirely sure, but scanning the employee's computer might be important too. I remember a practice question where we had to check for malware first.

upvoted 0 times

...

Cammy

7 months ago

I think the first step should be to review the actions taken by the employee and the email related to the event. It makes sense to understand what happened before jumping to conclusions.

upvoted 0 times

...

Tamera

7 months ago

I feel pretty good about this one. The incident response team should definitely start by reviewing the actions and email related to the phishing attack, as option B suggests. That will give them the information they need to determine the appropriate next steps, whether that's security awareness training or something else.

upvoted 0 times

...

Shonda

7 months ago

Okay, let's think this through. The key here is to respond quickly and effectively to the phishing attack. I think option B is the best choice - we need to review the details of what happened before we can decide on the next steps. Scanning the computer or terminating the employee might be premature at this stage.

upvoted 0 times

...

Telma

8 months ago

Hmm, I'm a little unsure about this one. Should we be scanning the employee's computer right away? Or is that jumping the gun a bit? I'm leaning towards option B, but I'm not 100% confident.

upvoted 0 times

...

Milly

8 months ago

This seems like a pretty straightforward incident response question. I'd go with option B - reviewing the actions taken by the employee and the email related to the event. That seems like the logical first step to gather information and understand what happened.

upvoted 0 times

...